IN THE CLAIMS 



The Claims are as Follows: 

1. (previously presented) A method of classifying a message transmitted over a 
network, comprising: 

executing instructions stored in a computer readable storage medium to 
determine the domain from which the message is purported to be sent; 

executing instructions stored in a computer readable storage medium to 
determine an IP address from the message, the IP address corresponding to a device 
which the message was relayed at some point in transmission of the message; 

executing instructions stored in a computer readable storage medium to 
associate the domain with the IP address to create an IP address and domain pair; 

executing instructions stored in a computer readable storage medium to classify 
the message according to the IP address and domain pair based on one or more 
classification variables associated with the IP address and domain pair; and 

executing instructions stored in a computer readable storage medium to assign a 
score to the IP address and domain pair, the score comprising a ratio of a first 
classification variable to a second classification variable, the one or more classification 
variables decaying with time. 

2. (previously presented) The method of claim 1, further comprising executing 
instructions in a computer readable storage medium to override a white list based on the 
classification. 

3. (previously presented) The method of claim 1, wherein classifying includes 
comparing the IP address and domain pair with a related IP address and domain pair. 
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4. (previously presented) The method of claim 1, wherein classifying includes checking 
classifications of other messages associated with the domain and different IP addresses. 

5. (original) The method of claim 1, wherein a plurality of IP addresses is associated 
with the domain. 

6. (original) The method of claim 1, wherein the IP address is associated with a plurality 
of domains. 

7. (original) The method of claim 1, wherein the IP address is a boundary IP address. 

8. (original) The method of claim \, wherein the IP address is preconfigured. 

9. (original) The method of claim 1, wherein the IP address is preconfigured to be one 
hop from a gateway IP address. 

10. (original) The method of claim 1, wherein the IP address is learned. 

11. (original) The method of claim 1, wherein the IP address is adaptively determined. 

12. (cancelled). 

13. (previously presented) The method of claim 1, wherein the IP address is a boundary 
IP address. 

14. (previously presented) The method of claim 1, wherein determining the domain 
from which the message is purported to be sent includes identifying the stated sender 
domain associated with the message. 
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15. (previously presented) The method of claim 1, wherein the domain is a domain 
associated with a boundary IP address. 



16. (original) The method of claim 1, wherein classifying includes consulting a white 
list. 

17. (original) The method of claim 1, wherein classifying includes classifying the 
message based on previous classifications made to the IP address and domain pair. 

18. (cancelled) 

19. (previously presented) The method of claim 1, wherein assigning the score includes 
determining a spam ratio. 

20. (previously presented) The method of claim 1, wherein assigning the score includes 
determining a spam rate. 

21. (previously presented) The method of claim 1, wherein assigning the score includes 
determining an estimated instantaneous spam rate. 

22. (cancelled) 

23. (previously presented) The method of claim 1, wherein classifying includes giving a 
classification variable greater weight relative to another classification variable. 

24. (previously presented) The method of claim 1, wherein classifying includes giving a 
classification variable associated with user classification greater weight relative to a 
classification variable associated with computer classification. 



4 



25. (original) The method of claim 1, wherein classifying includes giving an 
indeterminate classification a fraction of the weight of a good classification. 

26. (original) The method of claim 1, wherein classifying includes consulting a table 
indexed by IP address and domain. 

27. (original) The method of claim 1, wherein classifying includes consulting a table 
indexed by IP address and domain wherein each cell includes information about 
previous classifications. 

28. (previously presented) The method of claim 1, further comprising providing a 
classification based on the IP address and domain pair as input to another classifier. 

29. (previously presented) The method of claim 1, further including providing a 
classification based on the IP address and domain pair as input to a Bayesian classifier. 

30. (original) The method of claim 1, wherein classifying includes classifying the 
message based on the IP address. 

31. (original) The method of claim 1, wherein classifying includes classifying the 
message based on the domain. 

32. (original) The method of claim 1, wherein classifying includes classifying the 
message based on the domain and determining that the message was forged. 

33. (original) The method of claim 1, wherein classifying includes determining a score 
for the IP address. 
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34. (original) The method of claim 1, wherein classifying includes determining a score 
for the domain. 

35. (currently amended) A computer-readable storage medium having embodied 
thereon a program, the program being executable by a processor to perform a method 
for classifying a message, the method comprising: 

determining a domain from which the message is purported to be sent; 
determining an IP address from which the message was relayed at some point in 
transmission of the message; 

associating the domain with the IP address to create an IP address and domain 

pair; 

classifying the message according to the IP address and domain pair based on 
one or more classification variables associated with the IP address and domain pair; and 

assigning a score to the IP address and domain pair, the score comprising a ratio 
of a first classification variable to a second classification variable, the one or more 
classification variables decayed with time. 

36. (cancelled) 
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